SCADA (Supervisory Control and Data Acquisition) systems, as the core of industrial control systems and widely deployed in the nation’s critical industrial infrastructure, are attractive targets for malicious hackers due to their strategic importance. According to Check Point Research, 96% of daily cyberattacks targeting industrial control systems worldwide are known to be repeat attacks. Although current research on virus propagation assists operators in mitigating the damage caused by industrial viruses to SCADA systems, these modeling methods often fail to distinguish between initial and secondary virus invasions, making them unsuitable for modeling the repeated infection spread of industrial viruses. In order to solve this problem, we propose an immune memory-empowered SCADA-based industrial virus dynamic re-propagation model MLBRM (Memory- Latent- Broken- Robust- Memory). First, by introducing an M node, the model is used to realize the function of memorizing viral strains and to quickly immunize against and eliminate them. Besides, we perform dynamic analysis of the model and conduct the second invasion analysis to demonstrate the effect of the M nodes on suppressing the spread of the virus. Additionally, we conduct a model comparison experiment and perform simulations on the US power grid real dataset to demonstrate the effectiveness of the proposed model. Finally, we draw a conclusion and provide some advice for SCADA network operators to better protect the SCADA systems.

With the continuous development of cyber-attack technologies, attackers increasingly exploit zero-day vulnerabilities or leverage emerging techniques to launch sophisticated attacks, resulting in the persistent emergence of unknown cyber-attacks. However, traditional DL-based cyber-attack detection methods heavily rely on large-scale labeled training data. In practice, obtaining sufficient samples of unknown attacks is challenging, which makes it difficult for these methods to effectively defend against unknown cyber-attacks. In this paper, we propose a method for discovering unknown cyber threats empowered by genetic evolution without prior knowledge. Specifically, We, first mapped the network feature space into a gene framework, and divided the attack genes into a static gene region (SGZ) and a dynamic gene region (DGZ) according to the importance of the cyber-attack genes. Subsequently, leveraging the known attack genes, we utilized different gene evolution strategies and a Convolutional Autoencoder (CAE) to generate attack variants and potential unknown attack genes. Finally, we constructed a cyber-attack detection model incorporating both the global attention mechanism (GAM) and the local attention mechanism (LAM). The generated attack variants and unknown attack genes are the used to enhance the detection ability of the detection model for variants and unknown cyber-attacks. We conducted a large number of experiments on six real and authoritative network datasets. The experimental results show that in different scenario settings, the F1 scores of our proposed method for detecting unknown attacks are 84.64% and 95.77% respectively. The F1 score for detecting unknown attacks on the UNSW-NB15 dataset exceeds that of the baseline classifier. The F1 score for detecting unknown attacks on the CSE-CIC-IDS2018 dataset is 98.85%. In comparison with SOTA methods, the average F1 score is improved by 3.14%. In the evaluation of variant detection performance, the generation method we proposed improves the detection of variants by approximately 11.2%, surpassing generation methods such as the Conditional Generative Adversarial Network (CGAN) and the Variational Autoencoder (VAE). Meanwhile, we also comprehensively evaluated the generalization ability of our proposed method and the evolution ability of different evolution strategies on different datasets and through ablation experiments.

Application‐layer distributed denial of service (DDoS) attacks have become the main threat to Web server security. Because application‐layer DDoS attacks have strong concealability and high authenticity, intrusion detection technologies that rely solely on judging client authenticity cannot accurately detect such attacks. In addition, application‐layer DDoS attacks are periodic and repetitive, and attack targets suddenly in a short period. In this study, we propose an efficient application‐layer DDoS detection system based on improved random forest. Firstly, the Web logs are preprocessed to extract the user session characteristics. Subsequently, we propose a Session Identification based on Separation and Aggregation (SISA) method to accurately capture user sessions. Lastly, we propose an improved random forest classification algorithm based on feature weighting to address the issue of an increasing number of features leading to prolonged calculation times in the random forest algorithm, and as the feature dimension increases, there might be instances where no subfeature is related to the category to be classified. More importantly, we compare the request source IP with the malicious IP in the threat intelligence library to deal with the periodicity and repetition of application‐layer DDoS attacks. We conducted a comprehensive experiment on the publicly available Web log dataset and the threat intelligence database of the laboratory as well as the simulated generated attack log dataset in the laboratory environment. The experimental results show that the proposed detection system can control the false alarm rate and false alarm rate within a reasonable range, improving the detection efficiency further, the detection rate is 99.85%. In secondary attack detection experiments, our proposed detection method achieves a higher detection rate in a shorter time.

Unmanned aerial vehicles (UAVs) have experienced rapid development, permeating diverse domains. However, addressing security challenges in UAV networks remains daunting due to resource limitations and the high autonomy of UAV terminals. The current research on the UAV network intrusion detection lacks an efficient process covering each UAV terminal and a lightweight collaborative response mechanism between the UAVs and ground stations, which affects the performance of the UAV network intrusion detection. In this article, inspired by the vaccine distribution mechanism in artificial immune systems, we propose a hierarchical UAV network intrusion detection and response approach based on the vaccine distribution. Specifically, we first implement an immune game-based negative selection algorithm at the ground station, to effectively generate vaccines covering the immune space. Then, we distribute vaccines to the UAV terminals, empowering them with intrusion detection capabilities. Finally, we introduce a collaborative response mechanism to enable the intrusion detection at the UAV terminals and perform terminal state assessments. We evaluate the performance of our proposed approach on a large number of the real UAV network data sets. The experimental results indicate that our proposed intrusion detection approach for the UAV networks at the ground stations surpasses all the baseline models. In scenarios involving air-ground coordination, our suggested collaborative response approach proves to be effective in enabling intrusion detection at the UAV terminal, facilitating timely and efficient UAV intrusion detection. Moreover, we demonstrate on the ALFA and NSL-KDD data sets that our approach excels in detecting UAV network intrusions. Particularly, on real UAV network data (ALFA), the detection rate reaches 99.05% and the accuracy is 96.13% surpassing the other models by approximately 6%.

Presents corrections to the paper, (Corrections to “A Hierarchical Unmanned Aerial Vehicle Network Intrusion Detection and Response Approach Based on Immune Vaccine Distribution”).

Abstract The existing deep learning‐based face super‐resolution techniques can achieve satisfactory performance. However, these methods often incur large computational costs, and deeper networks generate redundant features. Some lightweight reconstruction networks also present limited representation ability because they ignore the entire contour and fine texture of the face for the sake of efficiency. Here, the authors propose a convenient alternating projection network (CAPN) for efficient face super‐resolution. First, the authors design a novel alternating projection block cascaded convolutional neural network to alternately achieve content consistency and learn detailed facial feature differences between super‐resolution and ground‐truth face images. Second, the self‐correction mechanism enabled the convolutional layer to capture faithful features that facilitate adaptive reconstruction. Moreover, a convenient connection operation can reduce the generation of redundant facial features while maintaining accurate reconstruction information. Extensive experiments demonstrated that the proposed CAPN can effectively reduce the computational cost while achieving competitive qualitative and quantitative results compared to state‐of‐the‐art super‐resolution methods.